fix(eslint): escape dynamic RegExp interpolations in actions/setup/js

[Copilot]

Resolves a cluster of gh-aw-custom/require-escaped-regexp-interpolation warnings across 9 files in actions/setup/js where values were interpolated into new RegExp() template literals without regex escaping.

Escaped — dynamic literal fragments

Values that represent plain text (variable names, key names, qualifier strings) are now passed through .replace(/[.*+?^${}()|[\]\\]/g, "\\$&") before interpolation:

File	Variable
comment_memory_helpers.cjs	COMMENT_MEMORY_TAG → new ESCAPED_COMMENT_MEMORY_TAG constant
frontmatter_hash_pure.cjs	key parameter
fuzz_template_substitution_harness.cjs	varName
interpolate_prompt.cjs	varName; exprForm (was dot-only escape, now full)
model_aliases.cjs	qualifier

// Beforeconstpattern=newRegExp(`^${key}:\\s*(true|false)\\s*$`,"m");// AfterconstescapedKey=key.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");constpattern=newRegExp(`^${escapedKey}:\\s*(true|false)\\s*$`,"m");

Suppressed — intentional regex fragments

Interpolations that are valid regex components (not literal text) are suppressed with targeted eslint-disable comments explaining the rationale:

• VERSION_SUFFIX_PATTERN in model_aliases.cjs — an explicit regex fragment string
• ISSUE_CLOSING_KEYWORDS / ISSUE_REFERENCE_PATTERN in safe_output_type_validator.cjs — composed regex alternation patterns
• regexPattern in glob_pattern_helpers.cjs — output of glob-to-regex conversion
• escapeRegex(...).replace(/\*/g, "[^/]*") in resolve_model_alias.cjs — already escaped; * → [^/]* is intentional
• fc / fenceLen in sanitize_content_core.cjs — fence character in a char class and numeric quantifier
• MAX_MEMORY_ID_LENGTH in comment_memory_helpers.cjs — numeric constant used as {1,N} quantifier

• Fixes[eslint-monster] actions/setup/js: escape dynamic RegExp interpolations #49669

[Copilot]

Pull request overview

Resolves issue #49669 by safely handling dynamic RegExp interpolation in setup scripts.

Changes:

• Escapes interpolated literal values before constructing regular expressions.
• Documents and suppresses warnings for intentional regex fragments.

Show a summary per file

File	Description
actions/setup/js/comment_memory_helpers.cjs	Escapes the memory tag and documents the numeric quantifier.
actions/setup/js/frontmatter_hash_pure.cjs	Escapes frontmatter keys.
actions/setup/js/fuzz_template_substitution_harness.cjs	Escapes template variable names.
actions/setup/js/glob_pattern_helpers.cjs	Documents intentional glob-derived regex interpolation.
actions/setup/js/interpolate_prompt.cjs	Fully escapes variable and experiment expressions.
actions/setup/js/model_aliases.cjs	Escapes qualifiers and documents version regex fragments.
actions/setup/js/resolve_model_alias.cjs	Documents intentional escaped glob interpolation.
actions/setup/js/safe_output_type_validator.cjs	Documents composed issue-reference regex fragments.
actions/setup/js/sanitize_content_core.cjs	Documents intentional fence regex components.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 9/9 changed files
• Comments generated: 0
• Review effort level: Balanced

[gh-aw-bot]

@copilot quick triage for this PR:

• Branch refresh: please update from main if GitHub does not auto-refresh it.
• Please run the pr-finisher skill before handoff and summarize any remaining maintainer action.

Run details: https://github.com/github/gh-aw/actions/runs/30724810309

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.14 AIC · ⌖ 5.97 AIC · ⊞ 8.1K · ◷
_{Comment /souschef to run again}

[github-actions]

🔍 Triage Summary

Field	Value
Category	bug
Risk	low
Priority	medium
Score	40/100 (impact 15 + urgency 10 + quality 15)
Recommended action	batch_review
Batch	eslint-monster

Escapes dynamic RegExp interpolations per eslint rule. CI green, reviewer commented.

Automated triage — see the triage report for full context.

Generated by 🔧 PR Triage Agent · auto · 40.3 AIC · ⌖ 4.01 AIC · ⊞ 8K · ◷

[pelikhan]

@copilot ensure there is a comprehensive test suite for each of these regexes

[github-actions]

⚠️PR Code Quality Reviewer failed during code quality review.

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR does not have the 'implementation' label and has ≤100 new lines of code in business logic directories (default_business_additions=0).

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

No action needed: This PR contains only production code changes to 9 JavaScript files in actions/setup/js/. No test files were added or modified. Test Quality Sentinel evaluation is not applicable for production-only PRs.

[github-actions]

The changes correctly fix all dynamic RegExp interpolation warnings. Literal text values are properly escaped via the standard /[.*+?^${}()|[\]\]/g pattern, and the eslint-disable suppressions each carry clear rationale distinguishing intentional regex fragments from literal inputs. No blocking issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 15.2 AIC · ⌖ 10.3 AIC · ⊞ 5.4K

[github-actions]

Skills-Based Review 🧠

Applied /tdd — one observation on test coverage, otherwise the changes look correct.

📋 Key Themes & Highlights

Key Themes

• Correct escaping strategy: The inline .replace(/[.*+?^${}()|[\]\]/g, "\\$&") pattern is the right idiom for escaping arbitrary text before interpolating into a RegExp.
• Well-reasoned suppressions: Every eslint-disable comment explains why the interpolation is intentional (regex fragment, numeric quantifier, already-escaped value). This is exactly the right approach.
• Missing regression test: parseBoolFromFrontmatter (and the similar interpolateVariables functions) now correctly escape keys/var names, but no test exercises a key that contains a regex-special character. A small test would lock in the fix and prevent silent regressions.

Positive Highlights

• ✅ Consistent application across all 9 affected files
• ✅ Clear, readable constant names (ESCAPED_COMMENT_MEMORY_TAG) for pre-computed escape results
• ✅ eslint-disable comments are targeted and well-documented

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 25.7 AIC · ⌖ 9.7 AIC · ⊞ 7.1K
_{Comment /matt to run again}

[github-actions]

[/tdd] No regression test covers a key containing regex-special characters (e.g. key = "a.b"). Before this fix, such a key would silently match unrelated frontmatter lines; adding a test locks in the behaviour.

💡 Suggested test

it('parseBoolFromFrontmatter handles regex-special chars in key',()=>{expect(parseBoolFromFrontmatter('a.b: true','a.b')).toBe(true);// Before this fix, 'a.b' matched 'aXb: true' because '.' was unescapedexpect(parseBoolFromFrontmatter('aXb: true','a.b')).toBe(false);});

@copilot please address this.

[github-actions]

🧪 Test Quality Sentinel Report

i️ Test Quality Score: N/A — No Tests Changed

This PR contains only production code changes. No test files (.test.cjs, .test.js, *_test.go, test_*.py) were added or modified.

📊 PR Summary

Aspect	Value
Files Changed	9
Production Files	9 (JavaScript .cjs files)
Test Files	0
Total Additions	17
Total Deletions	6

Files Modified:

• actions/setup/js/comment_memory_helpers.cjs (+3, -1)
• actions/setup/js/frontmatter_hash_pure.cjs (+2, -1)
• actions/setup/js/fuzz_template_substitution_harness.cjs (+1, -1)
• actions/setup/js/glob_pattern_helpers.cjs (+1, -0)
• actions/setup/js/interpolate_prompt.cjs (+2, -2)
• actions/setup/js/model_aliases.cjs (+3, -1)
• actions/setup/js/resolve_model_alias.cjs (+2, -0)
• actions/setup/js/safe_output_type_validator.cjs (+2, -0)
• actions/setup/js/sanitize_content_core.cjs (+1, -0)

Verdict

i️ No test analysis needed. Production-only PR without test changes. Test Quality Sentinel evaluation is not applicable.

🧪 Test quality analysis by Test Quality Sentinel · haiku45 · 14.6 AIC · ⌖ 4.67 AIC · ⊞ 8.4K · ◷
_{Comment /review to run again}